@grada-run/grada 0.0.1 → 0.33.0

package/tests/drift.test.js

@@ -0,0 +1,228 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+// NOTE: helper imports must stay above src imports: vi.mock factories run
+// during module evaluation and need the factories initialized.
+import { clackPromptsMockFactory } from './helpers/clack.js';
+import { telemetryMockFactory } from './helpers/telemetry.js';
+import { createTmpDirTracker } from './helpers/tmpdir.js';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { load as loadYaml } from 'js-yaml';
+import {
+    runDrift,
+    parseDriftArgs,
+    extractRoleArn,
+    extractPlanSummary,
+    scaffoldDriftWorkflow,
+} from '../src/commands/drift.js';
+import { trackEvent, flushTelemetry } from '../src/core/telemetry.js';
+
+vi.mock('@clack/prompts', () => clackPromptsMockFactory());
+
+vi.mock('../src/core/telemetry.js', (importOriginal) => telemetryMockFactory(importOriginal));
+
+const tmp = createTmpDirTracker();
+let exitSpy;
+let logSpy;
+
+function makeTmp() {
+    return tmp.makeTmp('drift-test-');
+}
+
+function writeDeployYml(dir, roleArn = 'arn:aws:iam::123456789012:role/myapp-github-actions-role') {
+    const workflows = path.join(dir, '.github', 'workflows');
+    fs.mkdirSync(workflows, { recursive: true });
+    fs.writeFileSync(
+        path.join(workflows, 'deploy.yml'),
+        `name: Deploy\njobs:\n  deploy:\n    steps:\n      - uses: anton-codes-iac/deploy-stack-action@v1\n        with:\n          role-to-assume: ${roleArn}\n`
+    );
+}
+
+function writeMainTf(dir, region = 'us-east-2') {
+    fs.mkdirSync(path.join(dir, 'terraform'), { recursive: true });
+    fs.writeFileSync(
+        path.join(dir, 'terraform', 'main.tf'),
+        `provider "aws" {\n  region = "${region}"\n}\nlocals {\n  app_name = "myapp\${local.env_suffix}"\n}\n`
+    );
+}
+
+beforeEach(() => {
+    tmp.reset();
+    vi.clearAllMocks();
+    exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {});
+    logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+});
+
+afterEach(() => {
+    exitSpy.mockRestore();
+    logSpy.mockRestore();
+    tmp.cleanup();
+});
+
+describe('parseDriftArgs', () => {
+    it('parses flags and treats drift init as --setup', () => {
+        expect(parseDriftArgs(['drift', '--setup', '--region', 'eu-west-1'])).toMatchObject({ setup: true, region: 'eu-west-1' });
+        expect(parseDriftArgs(['drift', 'init']).setup).toBe(true);
+        expect(parseDriftArgs(['drift']).setup).toBeUndefined();
+    });
+
+    it('collects unexpected positionals', () => {
+        expect(parseDriftArgs(['drift', 'bogus']).unexpectedPositionals).toEqual(['bogus']);
+    });
+});
+
+describe('extractRoleArn / extractPlanSummary', () => {
+    it('finds the OIDC role ARN in deploy.yml', () => {
+        expect(extractRoleArn('  role-to-assume: arn:aws:iam::1:role/x # comment')).toBe('arn:aws:iam::1:role/x');
+        expect(extractRoleArn('no anchor here')).toBeNull();
+    });
+
+    it('condenses plan output to changes plus the summary', () => {
+        const output = [
+            'random log line',
+            '# aws_lb.main will be updated',
+            '  ~ dns_name = "a" -> "b"',
+            '  + new = true',
+            '  - old = true',
+            'Plan: 0 to add, 1 to change, 0 to destroy.',
+        ].join('\n');
+        const summary = extractPlanSummary(output);
+        expect(summary).not.toContain('random log line');
+        expect(summary).toContain('# aws_lb.main will be updated');
+        expect(summary).toContain('Plan: 0 to add, 1 to change, 0 to destroy.');
+    });
+
+    it('caps long summaries', () => {
+        const output = Array.from({ length: 100 }, (_, i) => `  + line${i} = true`).join('\n');
+        const summary = extractPlanSummary(output);
+        expect(summary.split('\n')).toHaveLength(61);
+        expect(summary).toContain('more lines');
+    });
+});
+
+describe('scaffoldDriftWorkflow', () => {
+    it('renders region and role ARN into valid workflow YAML', () => {
+        const dir = makeTmp();
+        const result = scaffoldDriftWorkflow(dir, { region: 'eu-west-1', roleArn: 'arn:aws:iam::1:role/x' });
+        expect(result.ok).toBe(true);
+        const content = fs.readFileSync(path.join(dir, '.github', 'workflows', 'drift.yml'), 'utf8');
+        expect(content).toContain('AWS_REGION: eu-west-1');
+        expect(content).toContain('role-to-assume: arn:aws:iam::1:role/x');
+        expect(content).not.toContain('{{REGION}}');
+        expect(content).not.toContain('{{ROLE_ARN}}');
+        const parsed = loadYaml(content);
+        expect(parsed.on.schedule).toEqual([{ cron: '0 6 * * *' }]);
+        expect(parsed.on).toHaveProperty('workflow_dispatch');
+        expect(parsed.permissions).toMatchObject({ 'id-token': 'write', contents: 'read', issues: 'write' });
+        const steps = parsed.jobs.drift.steps;
+        expect(steps.some((step) => step.uses === 'actions/github-script@v7')).toBe(true);
+        expect(steps.some((step) => step.with?.terraform_wrapper === false)).toBe(true);
+    });
+
+    it('refuses to overwrite without --force', () => {
+        const dir = makeTmp();
+        scaffoldDriftWorkflow(dir, { region: 'us-east-2', roleArn: 'arn:aws:iam::1:role/x' });
+        expect(scaffoldDriftWorkflow(dir, { region: 'us-east-2', roleArn: 'arn:aws:iam::1:role/y' }).reason).toBe('exists');
+        const forced = scaffoldDriftWorkflow(dir, { region: 'us-east-2', roleArn: 'arn:aws:iam::1:role/y', force: true });
+        expect(forced.ok).toBe(true);
+        expect(fs.readFileSync(path.join(dir, '.github', 'workflows', 'drift.yml'), 'utf8')).toContain('role/y');
+    });
+});
+
+describe('runDrift --setup', () => {
+    it('scaffolds from the deploy workflow role ARN', async () => {
+        const dir = makeTmp();
+        writeDeployYml(dir);
+        writeMainTf(dir);
+        const result = await runDrift({ cwd: dir, setup: true });
+        expect(result.ok).toBe(true);
+        expect(result.file).toBe(path.join('.github', 'workflows', 'drift.yml'));
+        expect(fs.existsSync(path.join(dir, '.github', 'workflows', 'drift.yml'))).toBe(true);
+        expect(trackEvent).toHaveBeenCalledWith('drift_run', expect.objectContaining({ action: 'setup', success: true }));
+        expect(exitSpy).not.toHaveBeenCalled();
+    });
+
+    it('soft-fails when the workflow exists without --force', async () => {
+        const dir = makeTmp();
+        writeDeployYml(dir);
+        writeMainTf(dir);
+        await runDrift({ cwd: dir, setup: true });
+        const second = await runDrift({ cwd: dir, setup: true });
+        expect(second).toMatchObject({ ok: false, reason: 'drift-workflow-exists' });
+        expect(exitSpy).not.toHaveBeenCalled();
+        const forced = await runDrift({ cwd: dir, setup: true, force: true });
+        expect(forced.ok).toBe(true);
+    });
+
+    it('fails without a deploy workflow or role ARN', async () => {
+        const missing = makeTmp();
+        writeMainTf(missing);
+        const noWorkflow = await runDrift({ cwd: missing, setup: true });
+        expect(noWorkflow.reason).toBe('workflow-not-found');
+
+        const noArn = makeTmp();
+        writeMainTf(noArn);
+        const workflows = path.join(noArn, '.github', 'workflows');
+        fs.mkdirSync(workflows, { recursive: true });
+        fs.writeFileSync(path.join(workflows, 'deploy.yml'), 'name: Deploy\n');
+        const result = await runDrift({ cwd: noArn, setup: true });
+        expect(result.reason).toBe('role-arn-not-found');
+    });
+});
+
+describe('runDrift check mode', () => {
+    function checkOptions(dir, planResult, initResult = { status: 0, stdout: '', stderr: '' }) {
+        return {
+            cwd: dir,
+            spawnSyncImpl: vi.fn((bin, args) => {
+                if (args[0] === 'init') return initResult;
+                return planResult;
+            }),
+        };
+    }
+
+    it('reports clean on exit code 0', async () => {
+        const dir = makeTmp();
+        writeMainTf(dir);
+        const result = await runDrift(checkOptions(dir, { status: 0, stdout: 'No changes.', stderr: '' }));
+        expect(result).toMatchObject({ ok: true, drift: false });
+        expect(trackEvent).toHaveBeenCalledWith('drift_run', expect.objectContaining({ action: 'check', drift: false, success: true }));
+        expect(exitSpy).not.toHaveBeenCalled();
+    });
+
+    it('reports DRIFT_DETECTED with exit code 2', async () => {
+        const dir = makeTmp();
+        writeMainTf(dir);
+        const result = await runDrift(checkOptions(dir, {
+            status: 2,
+            stdout: '# aws_lb.main will be updated\n  ~ x = 1\nPlan: 0 to add, 1 to change, 0 to destroy.',
+            stderr: '',
+        }));
+        expect(result).toMatchObject({ ok: false, reason: 'drift-detected' });
+        expect(exitSpy).toHaveBeenCalledWith(2);
+        const output = logSpy.mock.calls.map((call) => String(call[0])).join('\n');
+        expect(output).toContain('Infrastructure drift detected');
+        expect(output).toContain('Plan: 0 to add, 1 to change, 0 to destroy.');
+    });
+
+    it('fails on exit code 1 and on init failures', async () => {
+        const dir = makeTmp();
+        writeMainTf(dir);
+        const failed = await runDrift(checkOptions(dir, { status: 1, stdout: '', stderr: 'Error: boom' }));
+        expect(failed.reason).toBe('terraform-plan-failed');
+
+        const initFailed = await runDrift(checkOptions(dir, { status: 0, stdout: '', stderr: '' }, { status: 1, stdout: '', stderr: 'init no' }));
+        expect(initFailed.reason).toBe('terraform-init-failed');
+    });
+
+    it('guides when terraform is missing or the project is uninitialized', async () => {
+        const dir = makeTmp();
+        writeMainTf(dir);
+        const enoent = await runDrift({ cwd: dir, spawnSyncImpl: () => ({ error: { code: 'ENOENT' } }) });
+        expect(enoent.reason).toBe('terraform-not-installed');
+
+        const bare = makeTmp();
+        const uninit = await runDrift({ cwd: bare });
+        expect(uninit.reason).toBe('terraform-not-initialized');
+    });
+});

package/tests/e2e/helpers.js

@@ -0,0 +1,122 @@
+// Shared helpers for the E2E suites (Tier 0 + Tier 1). Kept separate from
+// tests/helpers/ on purpose: unit mocks must never leak into black-box runs.
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+export const ROOT = path.resolve(HERE, '..', '..');
+export const CLI = path.join(ROOT, 'bin', 'cli.js');
+
+// Repo-local workspace root so CI can upload it as an artifact on failure.
+// Overridable via E2E_TMP_ROOT for local debugging.
+export const E2E_TMP_ROOT = process.env.E2E_TMP_ROOT || path.join(HERE, '.tmp');
+
+// Shared provider cache across runs (mirrors scripts/test-iac.js).
+const pluginCacheDir = path.join(os.tmpdir(), 'grada-e2e-plugin-cache');
+
+export function e2eEnv({ mockAws }) {
+    fs.mkdirSync(pluginCacheDir, { recursive: true });
+    const env = {
+        ...process.env,
+        DO_NOT_TRACK: '1',
+        TF_PLUGIN_CACHE_DIR: pluginCacheDir,
+    };
+    if (mockAws) {
+        env.CI_MOCK_AWS = 'true';
+    } else {
+        delete env.CI_MOCK_AWS;
+    }
+    return env;
+}
+
+export function commandExists(cmd) {
+    try {
+        const result = spawnSync(cmd, ['--version'], { stdio: 'pipe' });
+        return result.status === 0;
+    } catch {
+        return false;
+    }
+}
+
+// Fail fast with a helpful error when local prerequisites are missing.
+export function assertPrerequisites() {
+    if (!commandExists('terraform')) {
+        throw new Error(
+            'E2E requires the Terraform CLI on PATH (https://developer.hashicorp.com/terraform/install).'
+        );
+    }
+}
+
+export function makeTmpDir(prefix) {
+    fs.mkdirSync(E2E_TMP_ROOT, { recursive: true });
+    return fs.mkdtempSync(path.join(E2E_TMP_ROOT, `${prefix}-`));
+}
+
+export function removeDir(dir) {
+    fs.rmSync(dir, { recursive: true, force: true });
+}
+
+// Run the real CLI with stdin always closed (headless purity: a prompt
+// crashes loudly instead of hanging). Output is inherited for visibility
+// unless capture is requested for assertions.
+export function runCli(args, { cwd, env, capture = false } = {}) {
+    const result = spawnSync('node', [CLI, ...args], {
+        cwd,
+        env,
+        stdio: capture ? ['ignore', 'pipe', 'pipe'] : ['ignore', 'inherit', 'inherit'],
+        encoding: 'utf-8',
+    });
+    return {
+        status: result.status,
+        stdout: result.stdout ?? '',
+        stderr: result.stderr ?? '',
+        output: `${result.stdout ?? ''}\n${result.stderr ?? ''}`,
+    };
+}
+
+export function runTerraform(args, { cwd, env }) {
+    const result = spawnSync('terraform', args, {
+        cwd,
+        env,
+        stdio: ['ignore', 'inherit', 'inherit'],
+        encoding: 'utf-8',
+    });
+    if (result.status !== 0) {
+        throw new Error(`terraform ${args.join(' ')} failed with exit ${result.status}`);
+    }
+}
+
+// Isolated workspace that is removed on success and preserved (with its
+// path printed) on failure for debugging and CI artifact upload.
+export async function withTmpDir(prefix, fn) {
+    const dir = makeTmpDir(prefix);
+    try {
+        await fn(dir);
+    } catch (error) {
+        console.log(`E2E workspace preserved for debugging: ${dir}`);
+        throw error;
+    }
+    removeDir(dir);
+}
+
+export function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function readBackendValue(projectDir, key) {
+    const backend = fs.readFileSync(path.join(projectDir, 'terraform', 'backend.tf'), 'utf-8');
+    const match = backend.match(new RegExp(`${key}\\s*=\\s*"([^"]+)"`));
+    if (!match) throw new Error(`could not parse ${key} from terraform/backend.tf`);
+    return match[1];
+}
+
+export function readBackendBucket(projectDir) {
+    return readBackendValue(projectDir, 'bucket');
+}
+
+export function readBackendRegion(projectDir) {
+    return readBackendValue(projectDir, 'region');
+}

package/tests/e2e/tier0.e2e.test.js

@@ -0,0 +1,142 @@
+// Tier 0 E2E: fast, PR-friendly, no AWS credentials. Mock-AWS scaffold,
+// local checks, and failure-path contract pinning against the real CLI.
+import { describe, it, expect, beforeAll } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+import {
+    e2eEnv,
+    assertPrerequisites,
+    runCli,
+    runTerraform,
+    withTmpDir,
+} from './helpers.js';
+
+const env = e2eEnv({ mockAws: true });
+
+beforeAll(() => {
+    assertPrerequisites();
+});
+
+describe('Tier 0: scaffold (ECS)', () => {
+    it('inits, adds an addon, and generates valid Terraform', async () => {
+        await withTmpDir('tier0-ecs', async (dir) => {
+            const init = runCli(['init', '--target', 'ecs', '--headless'], { cwd: dir, env });
+            expect(init.status).toBe(0);
+
+            const add = runCli(['add', 'queue:sqs', '--headless'], { cwd: dir, env });
+            expect(add.status).toBe(0);
+
+            expect(fs.existsSync(path.join(dir, 'README.md'))).toBe(true);
+            expect(fs.existsSync(path.join(dir, 'terraform', 'main.tf'))).toBe(true);
+            expect(fs.existsSync(path.join(dir, 'terraform', 'sqs.tf'))).toBe(true);
+            const mainTf = fs.readFileSync(path.join(dir, 'terraform', 'main.tf'), 'utf-8');
+            expect(mainTf).toContain('SQS_QUEUE_URL');
+
+            runTerraform(['init', '-backend=false'], { cwd: path.join(dir, 'terraform'), env });
+            runTerraform(['validate'], { cwd: path.join(dir, 'terraform'), env });
+        });
+    });
+});
+
+describe('Tier 0: scaffold (Lambda)', () => {
+    it('inits a Lambda project with valid Terraform', async () => {
+        await withTmpDir('tier0-lambda', async (dir) => {
+            const init = runCli(['init', '--target', 'lambda', '--headless'], { cwd: dir, env });
+            expect(init.status).toBe(0);
+
+            const mainTf = fs.readFileSync(path.join(dir, 'terraform', 'main.tf'), 'utf-8');
+            expect(mainTf).toContain('resource "aws_lambda_function" "app"');
+
+            runTerraform(['init', '-backend=false'], { cwd: path.join(dir, 'terraform'), env });
+            runTerraform(['validate'], { cwd: path.join(dir, 'terraform'), env });
+        });
+    });
+});
+
+describe('Tier 0: addon matrix', () => {
+    // queue:sqs is covered by the ECS scaffold test above (including the
+    // SQS_QUEUE_URL env-injection assertion); the rest get one
+    // scaffold-and-validate pass each.
+    const ADDON_MATRIX = [
+        { capability: 'storage:s3', file: 's3.tf', extraArgs: [] },
+        { capability: 'db:dynamodb', file: 'dynamodb.tf', extraArgs: [] },
+        { capability: 'db:redis', file: 'redis.tf', extraArgs: [] },
+        { capability: 'ai:bedrock', file: 'bedrock.tf', extraArgs: [] },
+        { capability: 'email:ses', file: 'ses.tf', extraArgs: ['--domain', 'example.com'] },
+        { capability: 'cron', file: 'cron.tf', extraArgs: [] },
+    ];
+
+    for (const { capability, file, extraArgs } of ADDON_MATRIX) {
+        it(`scaffolds valid Terraform for ${capability}`, async () => {
+            await withTmpDir(`tier0-add-${capability.replace(':', '-')}`, async (dir) => {
+                const init = runCli(['init', '--target', 'ecs', '--headless'], { cwd: dir, env });
+                expect(init.status).toBe(0);
+
+                const add = runCli(['add', capability, ...extraArgs, '--headless'], { cwd: dir, env });
+                expect(add.status).toBe(0);
+                expect(fs.existsSync(path.join(dir, 'terraform', file))).toBe(true);
+
+                runTerraform(['init', '-backend=false'], { cwd: path.join(dir, 'terraform'), env });
+                runTerraform(['validate'], { cwd: path.join(dir, 'terraform'), env });
+            });
+        });
+    }
+
+    it('composes multiple addons via init --with', async () => {
+        await withTmpDir('tier0-add-combo', async (dir) => {
+            const init = runCli(['init', '--target', 'ecs', '--with', 'queue:sqs,db:redis', '--headless'], { cwd: dir, env });
+            expect(init.status).toBe(0);
+            expect(fs.existsSync(path.join(dir, 'terraform', 'sqs.tf'))).toBe(true);
+            expect(fs.existsSync(path.join(dir, 'terraform', 'redis.tf'))).toBe(true);
+
+            runTerraform(['init', '-backend=false'], { cwd: path.join(dir, 'terraform'), env });
+            runTerraform(['validate'], { cwd: path.join(dir, 'terraform'), env });
+        });
+    });
+});
+
+describe('Tier 0: local checks', () => {
+    it('ejects metadata from a scaffolded project', async () => {
+        await withTmpDir('tier0-eject', async (dir) => {
+            const init = runCli(['init', '--headless'], { cwd: dir, env });
+            expect(init.status).toBe(0);
+
+            const mainTfPath = path.join(dir, 'terraform', 'main.tf');
+            expect(fs.readFileSync(mainTfPath, 'utf-8')).toContain('ManagedBy');
+
+            const eject = runCli(['eject', '--yes'], { cwd: dir, env });
+            expect(eject.status).toBe(0);
+            expect(fs.readFileSync(mainTfPath, 'utf-8')).not.toContain('ManagedBy');
+        });
+    });
+
+    it('doctor exits 0', async () => {
+        await withTmpDir('tier0-doctor', async (dir) => {
+            const doctor = runCli(['doctor'], { cwd: dir, env });
+            expect(doctor.status).toBe(0);
+        });
+    });
+});
+
+describe('Tier 0: failure paths', () => {
+    it('apply outside a project exits 1 cleanly', async () => {
+        await withTmpDir('tier0-fail-apply', async (dir) => {
+            const result = runCli(['apply', '--headless'], { cwd: dir, env, capture: true });
+            expect(result.status).toBe(1);
+            expect(result.output).toContain('No terraform directory');
+            expect(result.output).not.toMatch(/^\s+at\s/m);
+        });
+    });
+
+    it('init with an invalid target exits 1 cleanly', async () => {
+        await withTmpDir('tier0-fail-target', async (dir) => {
+            // NOTE: --headless is required to reach flag validation: without
+            // it, init prompts for the target directory first and exits 0 on
+            // EOF (the spec shows this command without --headless).
+            const result = runCli(['init', '--target', 'fake-target', '--headless'], { cwd: dir, env, capture: true });
+            expect(result.status).toBe(1);
+            expect(result.output).toContain('Invalid compute target');
+            expect(result.output).not.toMatch(/^\s+at\s/m);
+        });
+    });
+});

package/tests/e2e/tier1.live.e2e.test.js

@@ -0,0 +1,118 @@
+// Tier 1 E2E: full live lifecycle against real AWS (nightly/manual only).
+// Skips gracefully without credentials. Validated in CI, not locally.
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { S3Client, HeadBucketCommand } from '@aws-sdk/client-s3';
+import fs from 'node:fs';
+import path from 'node:path';
+import {
+    e2eEnv,
+    assertPrerequisites,
+    makeTmpDir,
+    removeDir,
+    runCli,
+    sleep,
+    readBackendBucket,
+    readBackendRegion,
+} from './helpers.js';
+
+const env = e2eEnv({ mockAws: false });
+const STATUS_POLL_INTERVAL_MS = 15000;
+const STATUS_POLL_BUDGET_MS = 6 * 60 * 1000;
+const BUCKET_POLL_INTERVAL_MS = 10000;
+const BUCKET_POLL_BUDGET_MS = 3 * 60 * 1000;
+
+// Serial execution is mandatory (ordered lifecycle); the whole suite is
+// skipped without credentials. (Vitest 5 cannot chain .serial.skipIf.)
+const describeLive = process.env.AWS_ACCESS_KEY_ID ? describe.serial : describe.skip;
+
+describeLive('Tier 1: live lifecycle', () => {
+    let dir;
+    let suiteFailed = false;
+
+    beforeAll(() => {
+        assertPrerequisites();
+        dir = makeTmpDir('tier1-live');
+    });
+
+    afterAll(() => {
+        if (suiteFailed) {
+            console.log(`Tier 1 workspace preserved for debugging: ${dir}`);
+            return;
+        }
+        removeDir(dir);
+    });
+
+    async function step(fn) {
+        try {
+            await fn();
+        } catch (error) {
+            suiteFailed = true;
+            throw error;
+        }
+    }
+
+    it('init scaffolds the project', async () => {
+        await step(async () => {
+            const init = runCli(['init', '--target', 'ecs', '--headless'], { cwd: dir, env });
+            expect(init.status).toBe(0);
+            expect(fs.existsSync(path.join(dir, 'terraform', 'main.tf'))).toBe(true);
+        });
+    });
+
+    it('apply provisions infrastructure', async () => {
+        await step(async () => {
+            const apply = runCli(['apply', '--auto-approve'], { cwd: dir, env });
+            expect(apply.status).toBe(0);
+        });
+    });
+
+    it('status becomes healthy', async () => {
+        await step(async () => {
+            const deadline = Date.now() + STATUS_POLL_BUDGET_MS;
+            let healthy = false;
+            let lastOutput = '';
+            while (Date.now() < deadline) {
+                // --json exits 0 even when degraded, so the payload (not the
+                // exit code) drives the loop; parse failures just mean "wait".
+                const result = runCli(['status', '--json'], { cwd: dir, env, capture: true });
+                lastOutput = result.output;
+                try {
+                    healthy = JSON.parse(result.stdout).healthy === true;
+                } catch {
+                    healthy = false;
+                }
+                if (healthy) break;
+                await sleep(STATUS_POLL_INTERVAL_MS);
+            }
+            expect([healthy, lastOutput]).toEqual([true, expect.any(String)]);
+
+            const final = runCli(['status'], { cwd: dir, env });
+            expect(final.status).toBe(0);
+        });
+    });
+
+    it('destroy tears everything down', async () => {
+        await step(async () => {
+            const bucket = readBackendBucket(dir);
+            const region = readBackendRegion(dir);
+
+            const destroy = runCli(['destroy', '--yes'], { cwd: dir, env });
+            expect(destroy.status).toBe(0);
+
+            const s3 = new S3Client({ region });
+            const deadline = Date.now() + BUCKET_POLL_BUDGET_MS;
+            for (;;) {
+                try {
+                    await s3.send(new HeadBucketCommand({ Bucket: bucket }));
+                } catch (error) {
+                    if (error?.name === 'NotFound' || error?.$metadata?.httpStatusCode === 404) return;
+                    throw error;
+                }
+                if (Date.now() >= deadline) {
+                    throw new Error(`state bucket ${bucket} still exists after destroy`);
+                }
+                await sleep(BUCKET_POLL_INTERVAL_MS);
+            }
+        });
+    });
+});